Certificate Format Conversion

Convert certificates and keys between PEM, DER, PKCS#7, PKCS#12 and Java keystores.

• Convert PEM to PFX / PKCS#12

  Bundle a PEM certificate, its private key and the intermediate chain into a single .pfx file with openssl pkcs12 -export, including the legacy flags Windows and older Java need.

• Convert PEM to DER

  Convert a certificate, CSR or private key from Base64 PEM text to raw binary DER, using the right OpenSSL subcommand for each object type.

• Convert DER to PEM

  Turn a binary DER certificate, CSR or key into Base64 PEM text, including how to work out which subcommand a mystery .cer or .der file needs.

• Convert PFX / PKCS#12 to PEM

  Extract the certificate, private key and chain out of a .pfx or .p12 archive into separate PEM files, including the OpenSSL 3 legacy flag older archives need.

• Convert a .crt or .cer file to PEM

  A .crt file is often already PEM and needs only renaming. Here is how to tell, and what to run when it is really DER-encoded.

• Convert P7B / PKCS#7 to PEM

  Unpack a .p7b or .p7c certificate bundle into individual PEM certificates, and work out which of them is the leaf and which are intermediates.

• Convert PEM to P7B / PKCS#7

  Bundle one or more PEM certificates into a single .p7b file with openssl crl2pkcs7, for Windows and Java tools that expect a chain in PKCS#7 form.

• Convert a PKCS#1 key to PKCS#8

  Turn a BEGIN RSA PRIVATE KEY file into the BEGIN PRIVATE KEY form that Java, Go and most modern libraries require, with openssl pkcs8 -topk8.

• Convert a PKCS#8 key to PKCS#1

  Turn a BEGIN PRIVATE KEY file back into the traditional BEGIN RSA PRIVATE KEY form, including the -traditional flag OpenSSL 3 requires.

• Convert PEM to a Java keystore

  Get a PEM certificate and private key into a Java keystore by going through PKCS#12 with openssl, then importing with keytool. There is no direct route.

• Convert a Java keystore to PEM

  Extract the certificate and private key from a .jks keystore by converting it to PKCS#12 with keytool, then unpacking it with openssl.

• Convert PFX / PKCS#12 to a Java keystore

  Import a .pfx or .p12 archive into a Java keystore in a single keytool command, and check the alias and chain came across intact.